Typical flight control systems used in many aircraft rely upon a combination of direct mechanical linkages between the pilot's control devices and the aircraft flight control surfaces. Accordingly, when a pilot manipulates flight control devices such as the pedals, levers, and control column, mechanical linkages transmit the movement of the controls to aircraft flight control surfaces, such as the rudders, ailerons, and elevators. These mechanical linkages move the flight control surfaces appropriately in response to the pilot's actions.
The use of mechanical flight control systems provides several advantages. Not only is the system relatively simple with somewhat predictable failure modes and effects, but it also provides for direct control of the aircraft flight control surfaces. These mechanical flight control systems are also quite reliable, since aircraft manufacturers and operators have had long experience with the implementation, maintenance and repair of mechanical flight control systems. However, mechanical flight control systems generally require detailed inspections to ascertain the continued viability of the mechanical components and are also susceptible to failure due to the ordinary wear and tear associated with the movement of the mechanical parts over an extended period of time.
In conjunction with the advancement of analog and digital circuitry, new aircraft flight control systems have been developed for use in aircraft. Many of these new aircraft flight control systems are not reliant on direct mechanical linkages. These newer aircraft flight control systems use electronic controllers that receive and transmit analog and digital signals to control devices, such as hydraulic actuators, that in turn control the movement of aircraft flight control surfaces. This type of flight control system, known as a “fly-by-wire” system, provides significant advantages over standard mechanically linked flight systems.
The use of highly reliable electronic signals generated in response to pilot manipulation of flight deck controls or autopilot commands, instead of mechanical linkages, provides the possibility of improved overall system reliability and performance. Also, the systems can be easier to maintain since there is less mechanical failure due to worn components to be concerned with.
The fly-by-wire aircraft control system, however, is not failure proof and, like most advances in the art, introduces new failure points for consideration. In some cases, the signals generated by modern control fly-by-wire systems are very complex and some failures of the electronic subsystems may lead to loss of operational control. In addition, the data buses and/or wires interconnecting the control electronics, control actuators and sensors can become damaged or disconnected, thereby destroying or interfering with the pilot's ability to control the aircraft. Accordingly, various types of precautions are taken to guard against system failure. Some of these precautions include the use of redundant circuits and reconfiguration elements that can detect and mitigate failure in the circuits for the fly-by-wire flight control system.
In general, whenever a certain mode of failure for a given electronic subsystem is predictable, then a monitoring and response system can be developed and implemented to detect and mitigate the failure of the subsystem, when it fails according to the predicted mode. There are, however, certain complex subsystem elements for which the failure modes involve common mode design errors that are neither readily predictable nor are the symptoms of failure easily detectable because the failure may actually be part of the monitoring system or the redundancy protection.
For example, when an elevator control is monitored by sensing the motion of the elevator surface, the integrity of the sensor feedback signal is important to detect any undesirable variations in movement to permit failure detection. Likewise, the monitoring response paths that would shutdown or reconfigure the malfunctioning subsystem to mitigate any failure, is also important to the effectiveness of the monitoring system. If the communications path for these elements and subsystems is the same, or of a similar complex design, then the integrity of the monitoring system may be compromised by the same complexity issues as the control function itself. This situation can serve to decrease flight safety margins by decreasing the effectiveness of supposed isolation provided by the redundancy and monitoring of the electronic control systems of the aircraft.
In view of the foregoing, it should be appreciated that it would be desirable to sense and mitigate failures in the aircraft flight control system that may also circumvent the undesirable results of common-mode failures resulting from complexity in the primary control elements. In addition, it would be desirable to provide high reliable yet simple back-up operational flight control elements that can be integrated with the existing complex electronic equipment of the primary flight control system and the aircraft's primary flight control computer, and which would not be susceptible to the same errors as the complex portions of the electronic controls.